Changeset 37025

Timestamp:

03/17/2016 03:52:40 AM (9 years ago)

Author:

DrewAPicture

Message:

Docs: Clarify documentation for the xmlrpc_enabled filter to better explain that its scope only extends to methods requiring authentication.

When the xmlrpc_enabled filter was initially introduced in [21509], it was effectively intended to replace the `enable_xmlrpc' UI option, which only controlled whether authenticated XML-RPC methods were enabled, such as for publishing actions. This change clarifies the expected behavior and adds information about ways to more granularly control XML-RPC method and request behavior with related hooks.

Part props mensmaximus.
See #21509. Fixes #36055.

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -248 +248 @@
 
         /**
-         * Filter whether XML-RPC is enabled.
-         *
-         * This is the proper filter for turning off XML-RPC.
+         * Filter whether XML-RPC methods requiring authentication are enabled.
+         *
+         * Contrary to the way it's named, this filter does not control whether XML-RPC is *fully*
+         * enabled, rather, it only controls whether XML-RPC methods requiring authentication - such
+         * as for publishing purposes - are enabled.
+         *
+         * Further, the filter does not control whether pingbacks or other custom endpoints that don't
+         * require authentication are enabled. This behavior is expected, and due to how parity was matched
+         * with the `enable_xmlrpc` UI option the filter replaced when it was introduced in 3.5.
+         *
+         * To disable XML-RPC methods that require authentication, use:
+         *
+         *     add_filter( 'xmlrpc_enabled', '__return_false' );
+         *
+         * For more granular control over all XML-RPC methods and requests, see the {@see 'xmlrpc_methods'}
+         * and {@see 'xmlrpc_element_limit'} hooks.
          *
          * @since 3.5.0